Persistent workaround using local profile include (enforce mode, survives updates)
But this still has the problem of being a generic,all-app fix. a per-app rule isn't possible yet AFAIK because bwrap runs under a generic label regardless of which Flatpak app invoked it. A proper fix would need the originating app's label carried through the bwrap→fusermount3 path. Maybe this is what is in the works? Anwyay: Create /etc/apparmor.d/local/fusermount3: unix (receive, send) type=stream peer=(label=bwrap), unix (receive, send) type=stream peer=(label=unpriv_bwrap), Reload: sudo apparmor_parser -r /etc/apparmor.d/fusermount3 Keeps fusermount3 in enforce mode, survives package updates. Tested on Ubuntu 26.04, Bazaar 0.9.1 (Flatpak). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2130388 Title: Cannot install flatpaks from io.github.kolunmi.Bazaar To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2130388/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
